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Abstract 

An unconditionally secure authority-certified anonymous quantum key dis- 
tribution scheme using conjugate coding is presented, base on which we con- 
struct a quantum election scheme without the help of entanglement state. We 
show that this election scheme ensures the completeness, soundness, privacy, 
eligibility, unreusability, fairness and verifiability of a large-scale election in 
which the administrator and counter are semi-honest. This election scheme 
can work even if there exist loss and errors in quantum channels. In addition, 
any irregularity in this scheme is sensible. 
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1. Introduction 

Achieving security and privacy simultaneously is a problem that must be 
solved in a voting system if the system is to be used for serious large-scale 
government elections [22]. In a traditional paper ballots method, the voting 
system often uses a locked box to solve this problem: After filling out the 
ballots, the voters put the ballots into the box one by one so as to guarantee 
the privacy of the voters. With the advent of information age, more and more 
daily life matters are transacted through digital communication network. 
Electronic voting scheme is appealing as an alternative to the traditional 
paper ballots method. 
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The first cryptographic voting protocol [12] was suggested by Chaum in 
1981. This protocol uses pubhc key cryptography and rosters of digital 
pseudonyms to conceal the identity of votes, but it does not guarantee that 
the identity of voters cannot be traced. Later Chaum proposed a protocol 
that provided unconditionally security against tracing the voting[13]. How- 
ever, elections based on this protocol can be disrupted by a single voter who 
can break RSA. Paper [14] suggested an unconditionally secure solution of 
the so-called dinning cryptographers problem that can be used to guarantee 
unconditionally anonymity of the voters. Privacy in this scheme is assured, 
but the protocol cannot avoid a voter voting an arbitrary number times, 
so cheating is easy. Solving the privacy and fairness problems at the same 
time seems to be a drawback of cryptographic voting schemes. Over the 
years, much attention has been paid to electronic voting schemes [15-22]. In 
practice, an electronic voting scheme can use blind signature, homomorphic- 
encryption, and other classical cryptographic techniques. For example, a 
secure electronic voting scheme based on blind signature was presented in 
[19], and paper [15] presented a practical secret voting scheme which is suit- 
able for large scale election and solves the privacy and fairness problems at 
the same time. However, the security of these schemes depends on the solving 
of certain difficult mathematical problems, such as factoring large numbers 
and solving discrete logarithms. It could be easily broken with the emergence 
of quantum computers, thus allowing an attacker to disturb the election. 

The physics of quantum cryptography pioneers a new way of the election. 
Different from the classical cryptography, the security of quantum cryptogra- 
phy is based on the fundamental laws of quantum physics to provide uncon- 
ditional security [7-10]. For example, quantum key distribution can use the 
laws of physics as the basis for a scheme to distribute secure cryptographic 
keys[5]. Hence, more and more researchers show their interests in quantum 
election. 

As in an election scheme it is more desirable that the identity of a voter, 
rather than his vote, be kept secret, quantum anonymous transmission [6] 
seems to be an inspiration for quantum election. A few quantum election 
protocols in the context of this notion have been proposed recently: Vaccaro 
et al. [23] proposed quantum protocols for voting and surveying; a key feature 
of their schemes is the use of entangled states to ensure that the votes are 
anonymous and to allow the votes to be tallied. Two similar protocols[24, 
25] suggested the voters to apply local operations to an entangled state to 
guarantee the anonymity of participants in voting procedures, paper [25] also 
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presented a method of preventing voters from casting more than one vote. 
Another similar protocol based on quantum mechanics had been proposed 
in paper [26], which used quantum mechanics to maintain the privacy of the 
voters. In 2011, Horoshko and Kilin[27] proposed a new protocol for quantum 
anonymous voting, their protocol protected both the voters from a curious 
tallyman and all the participants from a dishonest voter in unconditional way. 
All the mentioned protocols provides unconditional anonymity of voting, but 
every voter in these protocols can only decide to vote for two alternatives, 
which may be impractical in an election that has many candidates. Unlike 
these schemes that using quantum entanglement for obtaining anonymity, 
paper [29] and paper [30] presented quantum voting schemes that involving 
many candidates. In paper [30] a blank ballot was an unknown quantum state 
for a voter, and the voter randomized his ballot to guarantee anonymity. But 
there was still a problem: as there was no way for a voter to verify whether 
his/her ballot had been counted correctly, the voter could not make sure that 
he/she had voted successfully. 

In this paper we present a quantum election scheme based on anonymous 
quantum key distribution. Our scheme should be more easier to implement 
compared with the schemes in paper [23-29], because we do not use quantum 
entanglement and the reading of the result do not need complicated mea- 
surement. In addition, the candidates in our scheme are not limited to two 
alternatives. Moreover, our scheme can ensure that each eligible voter can 
make sure that his/her ballot has been counted successfully compared with 
the scheme in Ref.[30]. 

The rest of this paper is organized as follows. In the next section, we 
present the unconditionally secure anonymous quantum key distribution. In 
section 3, we present our quantum election scheme in detail. In Section 4, 
we analyze the security of the scheme. Subsequently, we discuss the compar- 
ison between our scheme and the previous traditional and quantum election 
schemes in section 5. Finally, we make conclusions in section 6. 

2. Anonymous quantum key distribution 

2.1. AQKD protocol 

To start with, we present a protocol for anonymous quantum key distri- 
bution with unconditional security. 

We use the notation || to denote the concatenation of strings and Ek[M] 
to denote an unconditionally secure symmetric encryption algorithm which 
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encrypts message M by using one-time-use key k, and the length of k is equal 
to the length of m. 

Suppose someone Ui wants to anonymously establish a key with a certain 
entity Charlie with the help of another entity Bob. For this he uses the 
following protocol: 

Protocol 1. AQKD(f/i) 

Prerequisite: Ui has established a lOm-bit key Pm with Bob by directly con- 
tacting or using an unconditionally secure quantum key distribution protocol [2- 
4]. Where Pbi = {Pi\\xi\\yi\\zi). Here the entity Bob acts as the administrator, 
he only helps the users who pre-sharing with him to run the AQKD pro- 
tocol, in other words. Bob will certify the authority of each user Ui at the 
beginning of the protocol. 

Step 1. Ui sends pi to Bob via a secure classical channel. 

Step 2. Bob checks whether p^ is correct after he receiving it, if it 
is correct. Bob establishes a m-bit key kc and a (9-|-l)m-bit key kf,c with 
Charlie by directly contacting or using an unconditionally secure quantum 
key distribution protocol. Then he computes 



and sends it to Charlie via a secure classical channel. 

Step 3. When Charlie receives X', he uses kbc to decrypt it. After 
gaining the outcome (ferns','), he checks whether k'^ is equal to kc- If the 
check succeeds, Charlie can make sure that his outcome S'^ is equal to Bob's 
plaintext Si. 

Step 4. Ui randomly chooses two strings rji,rj2 € {0, 1}^™- to generate 
his qubits \ai) by the method of conjugate coding[l]: 



where r^i,Ti2 denote the j-th bit of rji,rj2, and if''" = = I = 



X = E,Jk,\\S,] 

= Ek,Af^c\\ix^\\yi\\zi)] 



(1) 



(2) 




Then Ui anonymously transmits \ai) to Charlie via an error-free quantum 
channel. 
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Step 5. Charlie randomly chooses the measuring basis to perform single- 
particle measurements the qubits \ai)' that he received. After gaining the 
outcome r^2) he randomly chooses a subset of the set {1, 2, ■ ■ ■ , 3m}, where 
(Tj = {d\, d}, - ■ ■ , 0?™}, with 1 ^ d\<d}< ■ ■ ■ <(i™ ^ 3m; then generates the 
string fi e {0, 1}^"*, where 

• Jo, for jecTi; 

// = S , , . , (3) 
[1, forj^cT,; 

where j G {1, 2, • • • , 3m} throughout. Then he computes 

F^-ir[^'^{r',^'^...ir',^'^ (4) 

and publicly publishes the group (Fj, fi) with the corresponding measur- 
ing basis of the qubits \ai)'. 

Step 6. Ui extracts = {dl,df,--- , o?f*} through the string fi that 
published by Charlie and computes 

F:^ir.^'^{ri^'^...iri^'^ (5) 

if F/ satisfies the following conditions: 

if Charhe measures jo;^*) 'correctly, then F-"^^ — pf^ (6) 
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where j G {1, 2, • • • , m} throughout, Ui generates the string r^a G {0, 1} 
where 

1, for Charlie measuring |q;/)' correctly; 
0, for Charlie measuring |q;^')' incorrectly; 
where j G {1, 2, ■ ■ ■ , 2m} throughout, with 

{el el--- , e^} = {1, 2, • • • , 3m} - a,, and e\<el< - - - Kef^. 

Subsequently Ui computes 

Yi^E^MVi^] (8) 

and anonymously sends (xj, Yj) to Charlie via a secure classical channel. 

Step 7. When receives (x'.K/), Charlie checks whether he has accepted 
x'i before. If he has not accepted before, he verifies whether x'i is equal to 
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Xi that recorded in his database. If it is not, Charhe rejects to accept ¥■'; 
otherwise Charhe uses Zi to decrypt Y-. With the outcome (yiH^^s), Charhe 
checks whether is equal to i/i. If it is true, Charlie uses r'^^ to extract the 
final key Gj, which made up by the measurement outcome of the qubits that 
Charlie has chosen the correct measuring basis. 

Now the protocol is completed, Ui establishes a key string Gi with Charlie 
anonymously. 

2.2. Security analysis 

As the qubits \ai) in the protocol is an unknown quantum state to others, 
it is impossible to make a copy. An attacker has to measure the initial qubits 
if he wants to get some useful information. However, the attacker does not 
know the encoding basis of the qubits, he will choose the wrong measuring 
basis with the probability 50% for each qubit, then introduce no less than 
25% error rate in the string F/ and to be detected by Ui in step 6. The 
probability that others except Ui and Vi get the correct x-bit key Gi is not 
more than (^)^, when x is large enough, the probability is negligible. So 
nobody except U and Charlie knows the value of Gi. As Charlie is not 
aware of t/j's identity IDi, Ui has established a x-bit key Gi with Charlie 
anonymously. 

2.3. Practicability analysis 

The protocol can also work even if there exist loss and errors in quantum 
channels. In order to establish an error-free key, Charlie can publish all the 
serial numbers and measuring basis of the qubits that he has received, then 
publish the check string Fi and its serial numbers /j in step 5. If the error rate 
of U-s string F/ is acceptable, Ui can make sure that the key distribution is 
successful. After verifying that the key distribution is successful, Ui extracts 

and computes the key string Gi which contains acceptable errors from ri2 
by using the serial numbers and measuring basis that published by Charlie, 
and subsequently uses Gi and a key redistribution protocol [11] to establish 
the final error-free key ki^. 

{1) Ui randomly chooses a string as the final key Kic, then uses a classic 
error correction coding(ECC) to encode it. We use Di to denote the error 
correction code of Kic. Then Ui computes 

Y, = E,Mr^3], Z, = G,(BD, (9) 
and sends {xi,Yi,Zi) to Charlie. 
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(2) When receives (x'j, F/, Charlie checks whether he has accepted x[ 
before. If he has not accepted x'^ before, he verifies whether x'^ is equal to 
Xi that recorded in his database. If it is not, Charlie rejects to accept F/; 
otherwise Charhe uses Zi to decrypt ¥[. With the outcome {y'i\\r[.^), Charlie 
checks whether y[ is equal to Ui. If it is, Charlie uses r^g to extract then 
he computes 

D[ = Z[ ®G'i = Di®e (10) 

then Charlie decodes D[ to get the final error-free key Kic. 

Obviously, if the error correction ability of the chosen error correction 
code is strong enough to correct the errors in Charlie will get the correct 
kic ^t last. 

Generally, a quantum key distribution(QKD) protocol is a key expansion 
protocol, in which the two parties in the protocol should pre-share a short 
key, which is used for identification and authentication of classical commu- 
nication, to distribute a new longer key. In our anonymous quantum key 
distribution(AQKD), Ui can anonymously establish a key with Charlie with 
the help of Bob under the condition that there is no key shared between Ui 
and Charlie in advance. In addition, the final key between Ui and Charlie is 
private to others(Bob included). The AQKD protocol plays a unique role in 
some cases(such as in an anonymous election scheme) although the final key 
that generated by the protocol is shorter than the keys that has been used 
up between Ui and Bob, Bob and Charlie during the protocol. 

3. Quantum election scheme 

3.1. Security definition and notations 

There are many properties that a perfect voting scheme should have. 
Reviewing the properties that described in the literatures[13, 15, 18], we 
define a secure quantum election scheme should have the following properties: 

(1) Completeness: All valid votes are counted correctly. 

(2) Soundness: The dishonest voter cannot disrupt the voting. 

(3) Privacy: The content of the ballots is invisible to others. 

(4) Eligibility: Only eligible voters are permitted to vote. 

(5) Unreusability: Each eligible voter can vote successfully only once. 

(6) Fairness: Nothing must affect the voting. 

(7) Verifiability: Each eligible voter can check whether his/her ballot has 
been counted successfully. 

We use IDi to represent the identity of the eligible voter Vi. 
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3.2. Quantum election scheme 

A complete voting process in our election scheme includes four phases: 
initial phase, authentication phase, key distribution phase and voting phase. 
Several voters V^-, j=l,2,- ■ ■ ,N, the voting administrator Bob, and the counter 
Charlie are also involved. 

In order to ensure the successful implement of the election, we assume 
the two parties Bob and Charlie in our scheme are semi- honest (honest but 
curious). In addition, they are two independent parties, that means they will 
not collaborate to trace a ballot. 

3.2.1. Initial phase 

The initial phase is as follows: 

Before the authentication phase, the voting administrator Bob will pub- 
lish asetiSc{0,l}^. Each element of the set is a s-bit string that randomly 
chosen by Bob to represent an eligible candidate. In addition. Bob will an- 
nounce the corresponding candidate of each element. In the election scheme, 
an eligible voter Vj chooses the corresponding element of one candidate as 
his ballot Vj. We assume s is large enough to ensure the probability that a 
random s-bit string be an element of set S is negligible. 

The voting administrator Bob establishes a key /cf,j, where fcfej = (A;j||aj||6j||cj), 
with every eligible voter Vj, j=l,2,- ■ ■ ,N, by directly contacting or using an 
unconditionally secure quantum key distribution protocol [2-4]. All the four 
parts of kbj are selected uniquely for Vj. 

All these work should be completed in advance. 

3.2.2. Authentication phase 

When the eligible voter Vj wants to vote, he sends a request by sending 
the group (/-Dj, kj) to Bob. 

When Bob receives {IDj,kj) and the corresponding qubits, he checks 
whether Vj has successfully applied for voting before. If Vj has applied suc- 
cessfully before. Bob rejects to accept his request; otherwise. Bob verifies 
the string kj, if it is correct. Bob accepts V^'s request and records the corre- 
sponding [i, IDj,ajbjCj) in a table with number i. (See Table. 1) 

At the end of the authentication phase. Bob announces the number of the 
verified voters (we denote it by n) and publishes a set that contains all the 
verified IDj, j E {1,2, ■ ■ ■ , N}. Now the scheme turns to the key distribution 
phase. 
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Table 1. Bob's list of the verified voters. 



Entry 


Identity 


Related information 


1 


IDt 


Si : {at,bt,ct) 


i 


IDj 


Si : {aj,bj,Cj) 


n 


IDi 


Sn : {ai,bi,ci) 



3.2.3. Key distribution phase 

After dealing with all the applied voter V,'s requests (IDj,kj), j G 
{1,2, ■■■ ,A^}, Bob helps each verified voter Vj to execute an anonymous 
quantum key distribution to establish a 2s-bit key Kic between Vj and Char- 
lie by running 

AQKD{Ui) 

with Ui = Vj. 

After establishing key strings with all the verified voters, Charlie publicly 
announces that the key distribution phase is completed, the scheme turns to 
the voting phase. 

Table 2. List of Charlie's key strings. 





Remark(a*) 


KcL 


KcR 


K'lcL 


KcR 


at 


KcL 


KcR 


aj 


K' 


K' 

^ncR 


ai 



Here = K^WKcR, and K^^KcR e {0, 1}^ 

3.2.4. Voting phase 

When the verified voter Vj makes sure that he has anonymously estab- 
lished a 2s-bit key kic with Charlie successfully, he chooses an element from 
set S as his ballot Vj and anonymously sends {Kid, Exi^^ivj]) to Charlie. 
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After receiving {KicL, Charlie checks whether Ki^L is in the first 

column of Table. 2. If it is, Charlie checks whether Kid has been accepted 
before. If not, Charlie extracts the corresponding group (^K'j^^^^ K'j^^j^^ Ojj) ^ 
where K[^^ = K^cl, from Table. 2 and uses K'-^j^ to decrypt Exi^j^lvj]. If the 
outcome Vj & S, Charlie counts Vj and accepts KicL- 

After deahng with all the groups {Ki^L , Ekicr b^j] ) > Charhe deletes the lines 
in which the first item i^*cL has not ever been accepted by him from Table. 2. 
Then Charlie publishes a set which contains all the corresponding strings 
{aj} of the accepted K'-^^. Both Bob and the verified voter Vj can verify 
whether Vj has voted successfully by searching the value of Oj in this set. Bob 
communicates with each verified voter that has not voted successfully to 
establish a new kbi, then allows these failed voters for a new round of election. 

While all the verified voters vote successfully, Charlie counts the num- 
ber of each candidate's ballots. Subsequently, he randomly arranges all the 
accepted groups {Ki^L^Vj) and publicly publishes them. The scheme is now 
completed. (See Table.3) 

Table 3. List of Ballots (for public). 



Ballot 


Additional information 




KicL 



4. Security analysis of the election scheme 

In this section, we are to discuss the security of the quantum election 
scheme. We will prove that the scheme has the properties of completeness, 
soundness, privacy, eligibility, unreusability, fairness and verifiability when 
the administrator and the counter are semi-honest. 

4-1. Completeness 

The completeness means that all the valid ballots in the scheme are 
counted correctly. In this quantum election scheme, if all the three par- 
ticipants (the voters, the voting administrator, and the counter) are honest, 
after receiving an eligible voter V^'s voting request. Bob will send the mes- 
sages Si to Charlie honestly in the key distribution phase; when Vj makes sure 



10 



that the anonymous key distribution protocol is successful, he will honestly 

send the messages {KicL, Ex.^jiivj]) to Charhe; After extracting V/s ballot Vj 
from the cipher Ek^^h [vj] , Charlie will count it honestly. So the result of the 
election is trustable. 

4-2. Soundness 

While a dishonest voter Vj wants to disrupt the voting, he may keep 
not sending the valid group (A'jcL, -E'^:-^^ [fj]) or sending an invalid group 
{KicL, Exi^j^ivx]), where represents an invalid candidate, to Charlie in the 
voting phase, then applying for a new round of voting. In the first case, 
Vj will be detected by Bob, because before a new round of voting Bob has 
to establish a new key with Vj. If Vj fails too much times. Bob will detect 
him/her. In the second case, Vj will be detected by Charlie in the voting 
phase. Therefore, the dishonest voter cannot disrupt the election. 

4-3. Privacy 

In the key distribution phase, the voter Vj sends his quantum blank vote 
\r]j) to the voting administrator Bob. As l^^j) is independent of Vj before the 
voting phase, neither an attacker nor a curious Bob can get anything about 
Vj even if they get the entire state \rij). As the anonymous quantum key 
distribution protocol in this scheme is unconditionally secure, only Charlie 
and Vj know the correct if Vj ensures that his anonymous quantum key 
distribution is successful; although Charlie knows the value of Vj, he cannot 
get the corresponding IDj. Hence, nobody except Vj can match IDj with 
the ballot Vj. 

In this scheme it is possible to assume that Bob and Charlie are indepen- 
dent parties, i.e., they will not cooperate to trace the ballots. 

4.4- Eligibility 

The eligibility of an voting scheme means only eligible voters are per- 
mitted to vote, and it is impossible for an ineligible voter to forge a valid 
ballot. As described in the authentication phase. Bob will check the identity 
of a voter and reject to accept his/her voting request if the voter cannot 
pass through the identity authentication, therefore only eligible voters are 
permitted to vote. 

If an ineligible voter V^ wants to vote successfully, he has only two ways, 
one is to personate an eligible voter Vj in the voting phase, the other is to 
generate a valid ballot in the voting phase. In the first case, suppose Ve has 
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intercepted V/s qubits Irji), he replaces Irji) by Irje) and sends Irje) to Charlie. 
In order to vote successfully, Ve has to computes 

Y,^E,.[bj\\m] 

and send the group {aj, Ye) to Charlie in the key distribution phase. However, 
Ve has no way to get the value of {aj,bj,Cj), thus it is impossible for him 
to compute the correct Ye, so he cannot personate Vj successfully; in the 
second case, Ve may monitor the classical channel to get a verified voter V^'s 
group {KieL,EK,,j^[vj]), and send his group {Kid, EK,,j, [ve]) to Charhe, if his 
group reaches earlier than Vj's group, Charlie will accept (i^TjcL, -Exjeflbe])- 
However, it is impossible for Ve to compute Exi^j^lve], for he does not has the 
encryption key KicR. At the same time, as s is large enough, the probability 
that a random s-bit string v^, be a valid ballot is negligible. Therefore it 
impossible for an attacker to forge a valid vote. 

In this paper we assume the administrator Bob and the counter Char- 
lie are semi-honest. Actually, a malicious administrator Bob or a malicious 
counter Charlie may also try to forge valid votes: as Bob knows {aj, bj, cj), he 
can easily personate the eligible voter Vj and vote successfully; in addition, a 
malicious Charlie may tamper the ballot of an eligible voter. Although these 
irregularities will be discovered by Vj at the end of the scheme, there is no way 
to distinguish between a dishonest voter and a malicious Bob or a malicious 
Charlie. To avoid this, we can use a distributed scheme, in which several 
independent parties, e.g., several candidates of the election, collaborate to 
act as the voting administrator and another several independent parties col- 
laborate to act as Charlie. They won't cooperate up forging invalid votes or 
tracing vahd ballots. The distributed scheme ensures the credibihty of the 
voting administrator and the counter. 

4.5. Unreusability 

In the authentication phase, before responding to an eligible voter T^'s 
voting request. Bob will check whether Vj has successfully apphed for voting 
before to avoid accepting V^'s another voting request; In addition, before ac- 
cepts a group {KicL, EKi^jf [vj]), Charlie will check whether the corresponding 
KicL has been accepted before to avoid accepting the group twice. Moreover, 
before a new round of voting, Charlie will delete the fines in which the first 
item has not ever been accepted from Table. 2 to avoid accepting an overdue 
group {KicL, ^KicRl'^^j]) that had not been send by Vi in the former round of 
voting. Hence, each eligible voter can vote successfully only once. 
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4-6. Fairness 

The fairness means that nothing must affect the voting, especially the 
counting of ballots doesn't affect the voting. In this scheme, the voting 
phase is done after the authentication phase and key distribution phase, and 
Charlie will not disclose the intermediate result of the election to others 
before the whole scheme is completed. Therefore the previous voters will not 
affect the subsequent voters. So this scheme is fair for all voters. 

4-7. Verifiability 

At the end of the scheme, Charlie will publish Table. 3 publicly to all the 
voters. Each eligible voter Vj can search his group {KicL, Vj) in this table. If 
{KicL,Vj) is in the table, Vj can make sure that his vote has been counted 
correctly. 

5. Discussion 

In a traditional electronic voting scheme, there is no reliable way of know- 
ing whether someone has successfully eavesdropped in the channel. Unlike 
the traditional electronic voting schemes that based on classical cryptog- 
raphy, any eavesdropping behavior of quantum information in our scheme 
will be discovered. As the quantum blank votes in the scheme are unknown 
qubits to others, it is impossible to make a copy of them, so the attacker 
has to measure the initial qubits if he wants to get some useful information. 
However, the attacker does not know the encoding basis of the qubits, it is 
impossible for him to perform a correct measurement; moreover, his incor- 
rect measurement will change the initial quantum blank vote and then to be 
detected by the voter in the key distribution phase. Once an eligible voter 
detects that his quantum blank vote has been changed, he will not send the 
encrypted ballot to the counter. In addition, as the quantum blank vote that 
transformed in the quantum channel are independent of the voter's choice, 
an attacker cannot get any useful information even if he intercepts the entire 
states. As a result, the attacker cannot get any available information. 

Compared with the previous quantum voting schemes in paper [23-29], 
Our scheme should be more easier to implement because we do not quantum 
entanglement. In view of the problem of verifiability that not mentioned in 
Ref.[30], we also discuss the verifiability of our scheme to make sure that 
every voter can check whether his/her vote has been counted successfully. 
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In this paper we present an unconditionally secure quantum election 
scheme. As there is no rehable way to prevent the participants from copy- 
ing the classical messages, we assume the administrator and counter in the 
scheme is semi- honest, we can use a distributed scheme to ensure the credi- 
bility of the voting administrator and the counter. A malicious voter cannot 
disrupt the voting and any irregularity in the scheme is sensible. The scheme 
can work even if the quantum channels exist certain loss and the error rate. 

6. Conclusion 

We present an unconditionally secure quantum election scheme based on 
anonymous quantum key distribution. Our scheme ensures the completeness, 
the soundness, the privacy, the eligibilitythe unreusability, the fairness and 
the verifiability of the quantum election scheme in which the administrator 
and counter are semi- honest. A malicious voter cannot disrupt the voting and 
any irregularity in the scheme is sensible. The key technique of our scheme 
is using unknown quantum states to execute authority-certified anonymous 
quantum key distribution with unconditional security. Different from previ- 
ous quantum voting schemes, we do not use quantum entanglement, and each 
eligible voter can check whether his/her vote has been counted successfully. 
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